[gatein-issues] [JBoss JIRA] Commented: (GTNPORTAL-1046) GateIn and secure CAS integration: problem with renew parameter
Marek Posolda (JIRA)
jira-events at lists.jboss.org
Thu Apr 15 08:15:26 EDT 2010
[ https://jira.jboss.org/jira/browse/GTNPORTAL-1046?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12525878#action_12525878 ]
Marek Posolda commented on GTNPORTAL-1046:
------------------------------------------
Retested and works fine with renew=true and renew=false. But I have one note:
- If using renew=true, then the URL needs to be changed also in gatein.ear/02portal.war/login/jsp/login.jsp:
<html>
<head>
<script type="text/javascript">
window.location = 'http://localhost:8888/cas/login?service=http://localhost:8080/portal/private/classic&renew=true';
</script>
</head>
<body>
</body>
</html>
When it is changed only in LoginRedirectFilter, then it works fine with GateIn with access via "Sign in" button but problem can occur with access via private url ( http://localhost:8080/portal/private/classic ). For correct work with private url is needed also change in login.jsp.
> GateIn and secure CAS integration: problem with renew parameter
> ---------------------------------------------------------------
>
> Key: GTNPORTAL-1046
> URL: https://jira.jboss.org/jira/browse/GTNPORTAL-1046
> Project: GateIn Portal
> Issue Type: Bug
> Security Level: Public(Everyone can see)
> Affects Versions: 3.0.0-GA
> Environment: GateIn+JBoss AS (localhost:8080) integrated with secure CAS,
> Tomcat+CAS with secure connector enabled (https://localhost:9443),
> Sun JDK 1.6
> Reporter: Marek Posolda
> Attachments: cas-renew-exception.txt
>
>
> I tested GateIn integration with secure CAS (because CASTGC sso cookie is by default enabled only in secure environment). So GateIn is on localhost:8080 and Tomcat with CAS is on https://localhost:9443. I tried this scenario:
> 1) Go to http://localhost::8080/portal/private/classic and beeing redirected to CAS page
> 2) Login in CAS page as root
> 3) I am redirected to GateIn and I am successfully authenticated as user root
> 4) Wait 2 minutes for session expiration (I am testing with HTTP session expiration timeout 1 minute)
> 5) Going again to http://localhost::8080/portal/private/classic
> 6) I am redirected to blank screen now. And exception in server log with this message: "Ticket failed validation specification. Possible errors could include attempting to validate a Proxy Ticket via a Service Ticket validator, or not complying with the renew true request."
> I am attaching full exception stacktrace (cas-renew-exception.txt).
> I founded that problem can occur if "renew=true" parameter is not used in login URL but is used in validation URL. It should be used in both URLs (login and validation) or in none of them. Some links:
> http://tp.its.yale.edu/pipermail/cas/2005-October/001707.html
> http://n4.nabble.com/Problem-in-Cas-renew-parameter-set-to-true-td261396.html
> So I tried two things:
> 1) Use renew in both login and validation URL. So I changed login.jsp to "https://localhost:9443/cas/login?service=http://localhost:8080/portal/private/classic&renew=true". This helps to avoid the issue but I am redirected to CAS screen after session expiration in GateIn
> 2) Avoid renew in both login and validation URL. Now it's hardcoded in org.gatein.sso.agent.cas.CASAgent.validateTicket so I uncomment the line setRenew(true) to avoid renew in validation URL. This also helps and now I am not redirected to CAS screen after session expiration. Because CAS grant me new valid ticket for new GateIn session.
> So conclusion: I think that renew should be used in both places or nowhere. Is it possible to make it configurable and avoid hardcoded setRenew(true) in CASAgent class?
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
More information about the gatein-issues
mailing list